Switch 2 Wireless

Lectures on LAN Switching - Part 11

2008-11-14T16:12:00.005+08:00

VLAN Trunk Protocol (VTP)

Before we go any further, let's discuss a feature that will help us manage VLANs in an ever expanding LAN network - VLAN Trunk Protocol, or simply, VTP.

This is one of my favorite interview questions before when I'm still conducting applicant interviews. Most will answer that it has something to do with Trunk configuration and management, rather than with VLANs. But that's just until they get smarter. =P

Moving forward, just imagine configuring and managing a new network with around 100 Catalyst Switches. To complicate the configuration a bit, every Switch needs to be configured with 100 VLANs. Imagine doing that repetitively on all 100 Switches. Hard right? =)

Isn't it more productive if I can just automatically replicate any VLAN configuration I make on one Switch to the other 99 Switches? Well, that's the main beauty of VLAN Trunk Protocol. VTP minimizes the administration overhead in Switches, particularly in configuring and managing VLANs across a Switched network.

You just need to configure at least one Switch as a VTP server, and the VLANs present on a VLAN Database will be replicated through all other Switches in the same VTP Domain. This will significantly reduce the time spent configuring VLANs on all your Switches. One downside though, VTP is a Cisco-proprietary protocol. You can only expect in on Cisco Catalyst Switches, and not anywhere else.

You may ask what the 'Trunk' in VTP is all about if this is only about VLAN management. Apparently, VTP will only work through Trunk connections. Any links that is only passing traffic from a single VLAN won't be able to pass through VTP advertisements.

Lectures on LAN Switching - Part 10

2008-11-13T18:57:00.003+08:00

Other Port Types: L3 port and SVI

We've already discussed Access and Trunk ports since they're the commonly used port types for Switches' physical interfaces (or ports). As our next topic, we're going to discuss a bit about Layer-3 (L3) ports, as well as Switch Virtual Interfaces (SVI) or more commonly known as VLAN Interfaces. These port types are generally available on Switches with routing or Layer-3 capabilities, such as:

Catalyst 3550
Catalyst 3560
Catalyst 3750
and most Modular Catalyst Switches

Layer-3 (L3) Port Type

L3 ports are basically routed ports. Meaning, these are previously "switched" ports that are configured to be similar to router ports. You'll want to connect this type of port to a router or to another routed port.

One main difference with real router ports is that L3 ports in Switches are not capable of having sub-interfaces.

Here's a sample configuration in creating an L3 port:

Switch#config terminal
Switch(config)#int fa0/1
Switch(config-if)# no switchport
Switch(config-if)# ip address 192.168.0.1 255.255.255.0
Switch(config-if)# no shut

You'll notice that the main configuration command is 'no switchport'. This is like literally saying to the port to stop being a "switched" port, and become the opposite (which is to be a "routed" port). The IP address configuration is just one of the most common configuration you'll do in a router port. Lastly, you need to issue a 'no shutdown' command to enable the port since all L3 ports are disabled by default.

Switch Virtual Interface

Switch Virtual Interfaces, or SVIs, are logical interfaces on a Layer-3 capable Switches. These serve as the gateway for the VLANs (or VLAN segments) to communicate with other VLANs. In a way, an SVI is similar to a router port wherein the router port leads to a network segment.

In its most basic function, you configure an IP address to the SVI to serve as the gateway IP address of a VLAN/network segment. Meaning, all PCs connected on ports that belong to a specific VLAN, will use the IP address of the corresponding SVI as their own gateway IP address. Moreover, configuring an IP address to an SVI enables PCs on a VLAN segment to communicate with other PCs on other VLAN segments (with configured IP addresses).

You also need to be careful in referencing SVIs. Since the more common term for SVI is Interface VLAN, a lot of people thought that this also refer to the VLAN itself. To be clear, VLAN is the network segment, while SVI (or Interface VLAN) is the gateway (much like a router interface).

Here's a sample configuration in creating an SVI:

Switch#config terminal
Switch(config)#int vlan 10
Switch(config-if)# ip address 192.168.0.1 255.255.255.0

Simple eh? =) Doing an 'interface vlan 10' effectively creates the logical SVI. To reiterate, putting an IP address effectively opens the "gate" to other VLANs for what we call "InterVLAN routing". Lastly, the IP address also serves as the telnet IP address of the Switch for any PC (on the same VLAN as the VLAN interface) who wishes to access the Switch.

IT-Related Inventions from Time's 50 Best Inventions of 2008

2008-10-31T08:32:00.004+08:00

This morning, I'm reading Time's article on what they consider as 50 Best Inventions of 2008. There's around seven inventions, I think, that can be considered IT-related (especially in the field of communications).

And now, here's the list:

9. The Orbital Internet

In space, no one can hear you scream. But you will be able to send e-mail, thanks to a new protocol being developed for use there. It's hard to maintain a stable connection in orbit, so the interplanetary Internet will have to be especially tolerant of delays and disruptions. In September, a satellite used the new protocol to relay an image of the Cape of Good Hope back to Earth.

10. The World's Fastest Computer

On May 26, at 3:30 in the morning, a $133 million supercomputer nicknamed Roadrunner broke the long-sought-after petaflop barrier: 1 quadrillion calculations per second. Built by IBM for Los Alamos National Laboratory, Roadrunner will be used primarily to simulate the effects of aging on nuclear weapons. Next up: the exaflop barrier.

13. The Memristor

Scientists have known it was possible for 37 years, but it took them that long to actually make a memristor, a new kind of circuit that remembers its history even when turned off. One possible application: a computer that flicks on instantly, like a lightbulb, with no boot-up required.

19. Montreal's Public Bike System

When lots of people use a communal resource — like, say, a cheap public bicycle-rental program — they tend to abuse it. So when the city of Montreal built its Public Bike System, nicknamed Bixi, the designers packed in all the technology they could find, in a desperate attempt to out-engineer human iniquity. The modular bike-rack stations are Web-enabled and solar-powered. The bicycles are designed with tons of sealed components to resist the savage beatings they will undoubtedly receive, and they're equipped with RFID tags so they're easily trackable. Too bad they can't redesign the riders too.

24. Bionic Contacts

The University of Washington's Babak Parviz has created a prototype "bionic" contact lens that creates a display over the wearer's visual field, so images, maps, data, etc., appear to float in midair. The lens works using tiny LEDs, which are powered by solar cells, and a radio-frequency receiver.

30. The Internet Of Things

In September, a group of high-tech companies that includes Cisco and Sun formed the IP for Smart Objects Alliance. Simply put, the organization intends to create a new kind of network that will allow sensor-enabled physical objects — appliances in your home, products in a factory, cars in a city — to talk to one another, the same way people communicate over the Internet.

47. Google's Floating Data Center

The hidden cost of the triumph of the Internet is the rise of the data center. The Net runs on huge complexes of hot, power-hungry servers that eat up real estate and energy in massive quantities — in 2006 data centers consumed a staggering 1.5% of the U.S.'s entire supply of electricity. Engineers at Google may have found a way out: the self-sufficient floating data center. According to a patent filed by Google, wind turbines and wave-powered generators will provide the electricity. Ocean water will cool the servers, which throw off huge amounts of heat. And offshore real estate is essentially free.

If you're wondering why I included Montreal's Public Bike System and Bionic Contacts, well, that's because of the use of radio-frequency communications (like RFID). And for last, I think the weirdest investion on the list is the New Ping Pong Serve which comes at number 36. Wow! =)

Cisco Books for CCDA and CCDP Certifications

2008-10-30T10:49:00.008+08:00

Right now, I've been reading, or maybe just browsing, these books for my CCDA certification goal:

CCDA Official Exam Certification Guide, Third Edition

By Anthony Bruno; Steve Jordan

Book Chapters

Chapter 1. Network Fundamentals Review
Chapter 2. Applying a Methodology to Network Design
Chapter 3. Structuring and Modularizing the Network
Chapter 4. Designing Basic Campus and Data Center Networks
Chapter 5. Designing Remote Connectivity
Chapter 6. Designing IP Addressing in the Network
Chapter 7. Selecting Routing Protocols for the Network
Chapter 8. Voice Network Design Considerations
Chapter 9. Wireless Network Design Considerations
Chapter 10. Evaluating Security Solutions for the Network
Appendix A. Answers to Review Questions and Case Studies
Appendix B. IPv4 Supplement
Appendix C. Open System Interconnection (OSI) Reference Model
Appendix D. Network Address Translation

Authorized Self-Study Guide Designing for Cisco Internetwork Solutions (DESGN), Second Edition

By Diane Teare

Book Chapters

Part I: General Network Design
Chapter 1. Network Design Methodology
Chapter 2. Network Structure Models

Part II: LAN and WAN Design
Chapter 3. Enterprise LAN Design
Chapter 4. Wireless LAN Design
Chapter 5. WAN Technologies
Chapter 6. WAN Design

Part III: The Internet Protocol and Routing Protocols
Chapter 8. Internet Protocol Version 6
Chapter 9. Routing Protocol Selection Criteria
Chapter 10. RIP and EIGRP Characteristics and Design
Chapter 11. OSPF and IS-IS
Chapter 12. Border Gateway Protocol, Route Manipulation, and IP Multicast

Part IV: Security, Convergence, and Network Management
Chapter 13. Security Management
Chapter 14. Security Technologies and Design
Chapter 15. Traditional Voice Architectures and IP Telephony Design
Chapter 16. Network Management Protocols

Part V: Comprehensive Scenarios
Chapter 17. Comprehensive Scenarios

Part VI: Appendixes
Appendix A. Answers to Chapter "Do I Know This Already?" Quizzes and Q&A Sections
Appendix B. The OSI Reference Model, TCP/IP Architecture, and Numeric Conversion

I actually like to read from last chapter and then going back. This prevents me from getting bored, and to absorb much of the information contained on these books. Weird huh? =)

As for CCDP that I'm planning to take afterwards, I'm still waiting for the updated version of this book:

CCDP Self-Study: Designing Cisco Network Architectures (ARCH)

By Keith Hutton; Amir Ranjbar

Book Chapters

Chapter 1. Introducing Cisco Network Service Architectures
Chapter 2. Designing Enterprise Campus Networks
Chapter 3. Designing Enterprise Edge Connectivity
Chapter 4. Designing Network Management Services
Chapter 5. Designing High-Availability Services
Chapter 6. Designing Security Services
Chapter 7. Designing QoS
Chapter 8. Designing IP Multicast Services
Chapter 9. Designing Virtual Private Networks
Chapter 10. Designing Enterprise Wireless Networks
Chapter 11. Designing IP Telephony Solutions
Chapter 12. Designing Content Networking Solutions
Chapter 13. Designing Storage Networking Solutions
Appendix A: Answers to Review Questions

I hope that I'll be able to accomplish these certifications before the end of the year. Wish me luck!

For more Cisco books, you can visit Amazon Bookswebsite.

Cisco wide Area Application Services (WAAS)

2008-10-29T22:05:00.002+08:00

I know this is a little off topic, but I don't want to waste the chance to discuss this a bit. =)

Cisco WAAS system is a set of devices called Wide Area Application Engines (WAEs) that work together to optimize TCP traffic over your wide area network (WAN). If you have client/server applications that wants to communicate to each other, and they happen to be between a WAN connection, the traffic will be intercepted and redirected to the WAEs. The WAEs will then act on behalf of the clients and servers. The WAEs examine the traffic and use application policies to determine whether to optimize the traffic or allow it to pass through your network unoptimized.

Just like in a Unified Wireless setup (LWAPP/WLC/WCS), a WAAS Central Manager can centrally configure and monitor the WAEs and application policies thru GUI. Application policies can also be created/configured for less common or less known applications that needs to pass thru a WAN link.

Cisco WAAS has the following benefits to enterprise networks:

Provide remote location (or branch office) users with LAN-like access to information and applications across a geographically distributed network (WAN).
Migrate and centrally manage application/file servers from remote locations to data centers or headquarters.
Efficiently use WAN link bandwidth through the use of advanced compression algorithms.
Virtualize print and other services to remote location users. Cisco WAAS allows you to configure a WAE with Windows in a virtual blade. This removes the need to have dedicated server to provide local services on remote location networks.
Improve application performance over the WAN by addressing the following common issues:

Low data rates (constrained bandwidth)
Slow delivery of frames (high network latency)
Higher rates of packet loss (low reliability)

For more info about Cisco WAAS, you can go to www.cisco.com/go/waas. Also, you maybe interested on this video from TechWise (install WAAS in 15mins or less!!).

Cisco Catalyst Switch Password Recovery

2008-10-16T04:29:00.005+08:00

If you need to know more about the background of doing Password Recovery on Cisco Catalyst Switches, you may be interested in visiting a series that I've done on my other blog. Although you can easily find the same document from the Cisco.com site, this series is more about the logic behind the steps mentioned on the official document. Furthermore, this will interrelate the procedures in different Catalyst Switch platforms in order to have a better understanding them.

So now, check these out!

Introduction
Part 1: Password Recovery on Fixed Switches (Small Boxes)
Part 2: Password Recovery on Modular Switches Running CatOS
Part 3: Password Recovery on Modular Switches Running IOS

You'll notice that it was divided into 3 different Password Recovery procedures. This is essential in highlighting the main differences and similarities in doing Password Recovery on different Catalyst Switch platforms.

Hope you enjoy them!

Lectures on LAN Switching – Part 09

2008-09-02T18:01:00.002+08:00

Sample Configuration – Access and Trunking

Now, it’s time for us to give sample configurations for Access mode switchports and Trunk mode switchports.

Access Mode Switchport Configuration:

Switch#config terminal
Switch(config)#int fa0/1
Switch(config-if)# switchport
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport mode access

*Note that this Access Mode Switchport Configuration is for Static VLAN configuration only. For Dynamic VLAN configuration, there should be an external VLAN Membership Policy Server (VMPS), and the configuration will be “switch port access vlan dynamic”

*The same configuration is used to assign a switchport to a VLAN. In this case, interface fa0/1 is assigned to VLAN 10

Trunk Mode Switchport Configuration:

Using Dot1q Tagging

Switch#config terminal
Switch(config)#int fa0/1
Switch(config-if)# switchport
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport trunk native 10
Switch(config-if)# switchport mode trunk

Using ISL Encapsulation

Switch#config terminal
Switch(config)#int fa0/1
Switch(config-if)# switchport
Switch(config-if)# switchport trunk encapsulation isl
Switch(config-if)# switchport mode trunk

On Trunk Mode Configuration, there are two other configuration options available:

Switch(config-if)#switchport trunk allowed vlan

This is to set allowed VLAN characteristics when interface is in trunking mode

Switch(config-if)#switchport trunk pruning vlan

This is to set pruning VLAN characteristics when interface is in trunking mode.

Lastly, if a switchport will be connected to another switchport (another Switch), the configuration on both switchports should be similar.

Network Reboot

2008-09-02T16:48:00.004+08:00

Geez! This is embarassing...

I haven't updated this blog since February. I guess I'm just too busy, and I can't make time to blog. =(

Some updates on what I've been doing for the past months:

I was assigned as a Technical Trainer since April, and I have to overhaul the LAN Switching and Wireless LAN training modules (not yet finished).
I've finished training 4 New Hires. But more to come!
And most recently (and importantly), I already resigned and will be starting on a new job by late September!

My formal job title will be Network Consultant, but I don't mind it much. I'm more excited about the new challenges that I'll face. Wish me luck! =)

In my current job, the challenges are more on the troubleshooting part. I love doing this, but then sometimes, you'll feel tired doing it again and again. In my new job, it will be more on the design part, and will be completely different. I guess that's what makes me very curious right now.

I'm also hoping that this will give me more time to prepare and achieve more certifications, and of course... blogging!

Lastly, even if I'm not blogging, I'm still reading/following my favorite blogs (It seems that even these blog authors are not updating their blogs frequently - except for Yuga):

This is what I'm doing in my precious free time during work hours!!! =P

Lectures on LAN Switching – Part 08

2008-02-09T21:05:00.004+08:00

802.1q Tagging vs. ISL Encapsulation

Currently, there are two trunking protocols being used in Cisco Catalyst Switches; 802.1q (Dot1q) and Inter-Switch Link (ISL). In choosing the trunking protocol to use, you need to check first if both Switches to be connected by a trunking link support the same trunking protocol. With mismatched trunking protocol, the Switches won’t understand how the packets are tagged or encapsulated.

But what are the differences between these protocols?

The main difference between these protocols is that ISL is Cisco proprietary, while Dot1q is an IEEE standard. In short, you can choose to use ISL if you are connecting two Cisco Catalyst Switches. On the other hand, you can use the Dot1q protocol if you need to connect a Cisco Catalyst Switch to a non-Cisco Switch (we refer to it as 3rd party device). Dot1q trunking protocol is usually supported by most non-Cisco Switches that we know.

The other difference between ISL and Dot1q trunking protocols are listed below:

ISL

All packets are encapsulated (external tagging)
Adds 26-byte ISL header and 4-byte CRC/FCS
VLAN ID is included in the ISL header
Packets are not altered
Packets are sent as ‘giants’

802.1q

All packets are encapsulated except those in Native VLAN
A ‘tag’ is inserted into packets, which extends maximum packet size to 1522 bytes from 1518 bytes
VLAN ID is included on the 802.1q tag
Packets are altered. CRC/FCS value is recomputed for the entire packet after the tag insertion
It presumes that there is only a single instance of STP

If we have this frame structure:

[DA][SA][Type/Length][Data][FCS]

ISL encapsulation will look like this:

[ISL Header][DA][SA][Type/Length][Data][FCS][New FCS]

On the other hand, Dot1q tagging will look like this:

[DA][SA][Dot1q Tag][Type/Length][Data][Recomputed FCS]

Native VLAN Concept

One thing unique with Dot1q trunking is the use of a Native VLAN. By default, both Dot1q and ISL trunking links allow traffic from all VLANs to pass through. There is also a need for ‘management’ frames to be exchanged between Switches (like CDP, VTP, DTP) over trunking connections.

The Native VLAN comes into play whenever there is a need to exchange ‘management’ frames between Switches. There’s no need for multiple instances of the same VTP advertisement to be exchanged just to cater to all the VLANs present on a Switch. In short, 10 VLANs won’t need 10 instances of the same ‘management’ frame. A single instance of the same frame can be exchanged through the Native VLAN.

On Catalyst Switches, VLAN1 is not only the pre-existing VLAN by default. It is also serves as the Native VLAN by default, and it is quite easy to change in both CatOS and IOS.

A quick note on trunking, both end of a trunking link should have the same configuration in order for the link to be up. This includes the Native VLAN configuration, or otherwise, the Switch may encounter ‘Native VLAN mismatch’ error.

Dynamic Trunking Protocol

Another topic that I will discuss about trunking is Dynamic Trunking Protocol (DTP). This protocol is used to negotiate the trunking status between Catalyst Switches’ switchport. By default, DTP is enabled on Switches, and all switchports participate with the trunking negotiation.

DTP provides 5 different statuses or modes to a switchport configured for a trunking link.

On. The trunk is enabled on the switchport regardless of the status of the switchport on the other side of a trunking link. DTP is also enabled and DTP frames are sent out of the link.

Off. The trunk is disabled on the switchport, but DTP is still enabled.

Auto. The switchport will be in passive mode, and will wait for instructions from the other side of the link (through received DTP frames) if it will be in trunk mode. The switchport will not send DTP frames eventhough DTP is enabled. It is not recommended for both sides to be configured in Auto mode.

Desirable. The switchport will actively seek to be in trunking status, and will send/receive DTP frames. But, it will still follow the wishes of the other side. If both of them are in Desirable mode, then a trunking link will most definitely be created. If paired with a switchport in Auto mode, the Desirable switchport will be the one to instruct the other side (to be in trunking status as much as possible).

Nonegotiate. The trunk is enabled on the switchport regardless of the status of the other side. But, DTP will be disabled and no DTP frames will be sent. This mode is useful if the other side is not capable of understanding DTP frames (possibly 3rd party devices).

For more information, you can start reading from this Trunking page from Cisco.com.

Lectures on LAN Switching – Part 07

2008-02-09T21:03:00.000+08:00

Connecting Different Switches

Let’s say you need to expand your current single-Switch network setup, and the current Switch you have is configured with multiple VLANs already. How can you accomplish this?

Well, in a single-VLAN Switch, you can easily do this by connecting a switchport from the original Switch to a switchport on the new Switch (since they belong to the same VLAN). The VLAN or the network segment will automatically extend to the other Switch without complex configuration.

But, what if you have multiple VLANs, just like the scenario given above? This scenario is more realistic given that most organizations will surely have different departments. These departments will represent the VLANs present on a Switch.

The easiest way for this scenario is for a switchport assigned to a specific VLAN, to be connected to a switchport on the other Switch that is assigned to the same VLAN. The same thing can be done to the others. So, if you have 10 VLANs configured, you’ll need to have 10 switchports (each assigned to a different VLAN) on one Switch, and connect them to 10 switchports on the other Switch.

Are you already seeing the problem? It’s quite obvious, right? =) By just extending the VLANs to the other switch, we already wasted a lot of switchports for the Switch-to-Switch connections. Can we just do it using a single link?

We’re in luck, because the answer is yes, and it can be done using Trunking.

Access vs. Trunk

Before we discuss Trunking any further, let’s discuss first the difference between the two most common switchport configurations for connecting Switches: Access mode and Trunk mode.

Access mode is the switchport mode used when you want to allow traffic only from a single VLAN. Packets coming from a Switch will pass through an Access link on its original form (no tagging involved). The receiving switcport (which is configured on the same VLAN) will assume that all packets coming in should be untagged and belongs to the VLAN configured to this switchport.

End devices like Personal Computers (PCs) also connect to a Switch thru Access ports. A PC’s Network Interface Card (NIC) should send and receive packets on its original form, given that PCs don’t normally understand any tagging concept, or even the concept of VLAN.

Trunk mode, on the other hand, is the switchport mode used when you want to allow traffic from different VLANs to pass through between Switches. Trunking uses the concept of tagging in order to identify a packet belonging to a certain VLAN. When a switchport sends a packet, it is automatically tagged with the VLAN ID before it goes out of the said switchport. On the other hand, the receiving switchport will remove and read the tagging or encapsulation, and assign it to the VLAN specified on the tag information.

With a trunking connection, the Switches gain the benefits of maximizing link utilization, as well as saving switchports from being wasted.

Juniper EX Series: Direct Competition to Cisco Catalyst

2008-02-04T16:57:00.000+08:00

Last week, Juniper introduced EX series of layer 2/3 switches. EX series was positioned for Enterprise networks, and would compete directly with Cisco's Catalyst series. With the introduced line-up, is Juniper ready to go head-to-head with Cisco? Will Juniper eventually get a sizable share of the Enterprise switch market? Lastly, how did Cisco react with this challenge?

Juniper: EX3200, EX3400, EX8200

Juniper's EX series currently consists of three lines; EX3200 EX3400, and EX8200.

EX3200 switches are fixed configuration 10/100/1000 Ethernet ports with PoE support, while EX4200 switches have the 'Virtual Chassis Technology' (I'm not sure if this can really be called 'modular'), and stackable. On the other hand, EX8200 switches will be modular (8-slot and 16-slot chassis types) and will support 10G Ethernet, but it won't be available yet 'til late 2008.

It is something to note that Juniper's approach was to develop their own product line. This is important since design considerations would have included great compatibility with their existing products. EX switch series also support Unified Access Control (UAC), which is Junipers version of NAC, for built-in security feature.

Comparison to Cisco Catalyst

From the available information in the Internet, EX3200 will be matched against the Catalyst 3560 series, while the EX-4200 will be matched against Catalyst 3750 series (due to the "Stackability" feature). Lastly, EX8200 will up against the Catalyst 6500 series, and I tell you guys, this is something to watch out for! =)

As early as now (or maybe a few months ago), I think Cisco is already preparing its 'counter-punch' to Juniper. Maybe the first few points to be raised will be the investment protection if you buy a new lineup, and Juniper's readiness for the Enterprise market. A lot of write ups concentrates on the features, but I'm assuming that most network managers will weigh cost-effectiveness and dependability more than how many features are available.

Investment Protection and Technical Support

When it comes to purchasing new devices, a lot of IT managers always want to know how long a device will last. And in relation to that, managers also want to know how good is the support they will receive if they encounter problems with the device. On these fronts, Cisco has definitely a great advantage.

Juniper needs to show how cost-effective it will be for managers to consider the EX series over Catalyst switches for new implementations. And more, if they want to convince managers to replace existing and aging network setups.

Also, Juniper has no experience with the Enterprise switching field when it comes to technical support, and product compatibility to every possible situation. They may have successes with routers, but I learned (the hard way) that what you know about routers wouldn’t always apply with switches.

Lastly, I'm also betting that Juniper still has to experience the nightmare of compatibility problems. New products will always have these problems of compatibility with existing products. You cannot always assume that a buyer will be loyal to a single brand, right?

Disclaimer: Yes, I'm a Cisco fan. But I still believe that Cisco's main weakness is it price competitiveness. This is where I think Juniper can make an opening.

Time Flies Fast in Networking

2008-02-04T11:41:00.000+08:00

What? It's 2008 already? And, we're already on the second month?? What happened to January??!

Geez... I only planned for a month of absence last December. I needed that time to recover from piles of paperworks on my desk. As well as to be prepared for the incoming year (lots of opportunities and challenges for my team!). I never thought I would also consume the first month of 2008 to complete all those tasks.

I admit that I neglected this site, and missed on my chances to blog about some interesting developments in the Networking realm. Now, I have these lists of missed events:

CES (how come I missed this one?)
Aruba Acquisition of AirWave (what's the point?)
Nexus 7000 - Cisco's Data Center Class Switching System (what else?)
EX - Juniper's Entry to the Enterprise Switching Business (is Cisco threatened?)

I need to get going now. No need to cry over spilled milk, or I'll miss more opportunities this month. =)

Happy Chinese New Year!

Huawei Smart Phone Plan on 2008

2007-11-27T18:40:00.000+08:00

I came across this news article about the plan of Huawei to launch smart phones next year. Interestingly, they haven’t given out details yet of the specs that will define this smart phone (OS and radio access mode).

The article notes that Huawei’s decision on the specs will weigh heavily on the requirements of their operator customers. It’s also noted that Huawei is not keen in adding WLAN feature on their first smart phone, given that they are mainly talking “to mobile carriers, who tend to view hand-off to a WLAN as lost revenue for them, combined with an operational challenge of maintaining call quality when a user goes onto the unlicensed spectrum of WiFi connectivity.”

This is definitely something to watch out for. Let’s see if Huawei can make a dent on the smart phone arena given that it already has dominance in India and China.

Thanksgiving Holiday 2007

2007-11-27T10:51:00.000+08:00

We just ended one of the happiest weeks in our organization's support calendar. Of course, I’m talking about the U.S. Thanksgiving week! =)

During the weekdays before Thanksgiving Day and the weekend adjacent to it, we had a much lower case volume, thus translating to a fewer support that we need to do. Stress level is definitely down during this week, and we’re able to catch up with other responsibilities (research, lab recreates, collaboration, etc.) that we normally do for our customers.

It is quite fascinating to note that U.S. Networking Professionals (or the general American population) leave their work and worries behind, and enjoy this holiday. Sometimes, we even feel that Thanksgiving Day is a lot more important than Christmas Day or the New Year’s Day.

Even our counterparts in the U.S. are taking leave from work. Thus, our Australian and European counterparts are obliged to extend their support hours earlier and later respectively. Too bad for them. =P

Most of our U.S. customers want to have an extended vacation that coincides to this holiday, thus they tend to finish a lot of their work before the holiday. This also translates to a spike in case volume the week before the holiday. We specially feel the effect during weekends (when they are already ‘cramming’ to finish scheduled network tasks).

And within the holiday week itself, we receive a lot of Out-of-Office (OOO) advisories from our customers noting that they will be in extended vacation and they won’t be able to continue with any cases that they left us with.

It is also good to note that we are left with a few of our Australian customers, and a lot of our Asian customers (not that we’re complaining) who are less likely inclined or accustomed to the Thanksgiving holiday. Of course, they don’t even have it as a holiday. =P

Lastly, this Monday, November 26, 2007, we encountered a spike in case volume. This is due to the fact that most U.S. Network Professionals already came back from their holiday vacation. It also means that everyone is now back to the realities of life.

That includes us. So, back to work guys!

Lectures on LAN Switching – Part 06

2007-11-25T12:36:00.000+08:00

VLAN Configuration in Cisco Catalyst Switches

For this lecture, I will only give the basic commands to easily configure VLANs on Catalyst Switches. You will also notice the fundamental difference in configuring a Catalyst Switch with CatOS, and one with IOS. This lecture will so show the slight difference in configuring an IOS-based Catalyst Switch the ‘old way’ versus the ‘new way’.

For CatOS based switches:

Add a VLAN

set vlan (vlan id) (mod/port)

Delete a VLAN

clear vlan (vlan id)

Show the VLAN list

show vlan

For IOS based switches (Old Way):

*Enter VLAN Database first from Privileged Exec Mode (Enable Mode)

vlan database

*Ensure that the Switch is in VTP Server Mode

vtp server

Add a VLAN

vlan (vlan id)

Delete a VLAN

no vlan (vlan id)

Show the VLAN list from Privileged Exec Mode

show vlan

For IOS based switches (New Way):

*Enter Global Configuration Mode first from Privileged Exec Mode (Enable Mode)

configure terminal

*Ensure that the Switch is in VTP Server Mode

vtp server

Add a VLAN

vlan (vlan id)

Delete a VLAN

no vlan (vlan id)

Show the VLAN list from Privileged Exec Mode

show vlan

For additional VLAN configuration options and VLAN-related information, the Cisco.com website offers a lot of free documentation.

Lectures on LAN Switching – Part 05

2007-11-25T12:34:00.000+08:00

VLAN Tagging

You may be wondering how a Switch can track packets that belong to a certain VLAN to stay within that same VLAN. Let’s say you have switch ports 1 and 2 that belong to VLAN 10 and the rest of the ports on a Switch belong to VLAN 1. How can a packet received by switch port 1 (and destined for switch port 2) stays within the same VLAN segment and doesn’t stray into the other switch ports in VLAN 1?

Well, this is possible thru the use of VLAN Tagging that is present in Switches that utilizes VLANs. VLAN Tagging is used to identify packets inside a Switch. So in our scenario above, packets entering switch port 1 will be tagged with VLAN 10 ID and the Switch can then identify to which ports these packets can go out. In this case, the packets can only exit thru switch port 2.

The following will give detail to the whole process:

When a packet enters a Switch thru one of the ports, the packet FCS will be checked first to detect any corruption in the whole packet.
Once the FCS is confirmed to be good, the VLAN ID tag will be attached to the packet before it will be ‘switched’ to the destination switch port (where it will exit out).
On the destination switch port (also known as the ‘egress port’), the VLAN ID tag will be removed before it will be transmitted out of the switch port.

The whole VLAN Tagging process is only known to the Switch, and any PCs (or any end devices) connected to the Switch is unaware of the VLAN tags. When a PC transmits a packet from its NIC, the packet is in its original format before being received (and before being tagged) by the switch port. And before a switch port transmits a packet out, the packet is returned to its original format (being untagged) and the receiving NIC of a PC won’t notice any difference or alteration before accepting the packet.

Lastly, in Cisco Catalyst Switches, VLAN Tagging is handled by a separate ASIC to off-load the whole process from the switch CPU.

Amazon Wish List - Wireless

2007-11-21T20:48:00.000+08:00

Recently, I compiled a list of books that I'm planning to buy from Amazon. Or at least, pray that my boss will buy these books for our mini-library. =P These books are great resources if you want to be a 'Specialist' in Wireless LAN.

From time to time, I'll update this list if I come across another good book.

802.11 Wireless Networks: The Definitive Guide

802.11 Wireless Network Site Surveying and Installation

802.11 Wireless LAN Fundamentals

Cisco 802.11 Wireless Networking Quick Reference

802.11 Security

Cisco Wireless LAN Security

Maximum Wireless Security

End of DST 2007

2007-10-28T15:00:00.000+08:00

We’ve just finished our last Sunday shift during DST. November 3 is the first Sunday of November as well as the end of U.S. Daylight Saving Time. Today is quite unusual for us because we rendered an additional 30 minutes to our shift. This is in order for our organization to adjust with the end of the U.S. DST.

Last March, we had the same scenario. It was also very unique in a way since it was the initial implementation of the changes in the U.S. DST based on the Energy Policy Act. A lot of networking devices, which have DST feature in time keeping, were affected by this change, thus there’s a need to update them with a software patch or a manual workaround.

For a few days, we had a lot of customers who are asking assistance on how to apply the fix/workaround. Although this shouldn’t have a big impact on any network operation, a lot of network administrators were keen in time accuracy.

Now, we will be expecting a few customers still asking questions or assistance about this change. Fortunately for Cisco devices, we have a link to refer them. This document is actually a ‘catch-all’ as it informs of the different devices affected, and how to correct them.

Lectures on LAN Switching – Part 04

2007-10-28T14:56:00.000+08:00

Virtual LAN (VLAN)

Imagine managing a LAN for a company that is located on a 3-floor office building. Let’s say each floor has a Switch connecting at least 2 Hubs on every floor, and these 3 Switches are connected to each other. This will effectively creates 8 separate collision domains, but still within a single broadcast domain.

If each floor belongs to a different department, you wouldn’t want to have them sharing the same broadcast domain. Let’s say one of the floors houses the Finance department, surely you wouldn’t like them sharing the same broadcast domain with other departments due to possible leaks of confidential information being passed between PCs in Finance.

In order to prevent this, you need to place each floor in a different broadcast domain. The first option that you may think of is to buy a Router, given that a Router can break-up big broadcast domain into smaller ones. A Router can definitely prevent information leak in the given LAN setup.

But buying a Router has its downside. Currently, the cost of Router interfaces is still expensive, and it may not be viable yet for your company to invest into a Router with more than 2 interfaces. This is true especially if you don’t really need to ‘route’ packets, which is the main function of a Router.

With that, utilizing Virtual LAN (VLAN) will be a better option in the given setup. VLAN is a way of doing ‘micro-segmentation’ on a LAN topology for both Layer 2 and Layer 3. As you have already guessed, this micro-segmentation results into having separate broadcast domain, thus providing information security between VLANs.

On Cisco Catalyst Switches, any switch port can be assigned to any VLAN (static VLAN assignment). As such, you may only need a lone Switch to connect all your hubs and PCs on all floors, and just a apply VLAN assignments to group the switch ports into different department. A VLAN is still considered a LAN segment, but with only a single collision domain.

In case you’ll need the VLANs to communicate to each other, you’ll need a routing device (like Router or multi-layer Switch), to enable what we call ‘Inter-VLAN routing’. In most enterprise networks, Inter-VLAN routing is used in core Switches.

Lastly, in case of expansion and there’s a need to have more Switch ports, you can just add more Switches to the setup without major configuration changes. I’ll be discussing more about this on a separate entry.

Cisco PSIRT: EAP Vulnerability

2007-10-25T19:25:00.000+08:00

Last October 19, published a Cisco Security Response advisory for vulnerability on Extensible Authentication Protocol (EAP) implementation. The vulnerability shows when Cisco devices supporting EAP processed a crafted EAP Response Identity packet.

EAP is mainly used by Cisco as an authentication feature in wired and wireless network setups. The affected devices include Wireless Access Point and Bridges running autonomous IOS (non-LWAPP), and Catalyst Switches running either IOS or CatOS.

The link to the Cisco Security Response lists all the specific IOS/CatOS software versions affected, and the equivalent first-fixed versions to upgrade to in order to prevent the vulnerability. There’s also a list of related devices that are not affected.

In a situation like this, there’s no other option or workaround but to upgrade to the software versions mentioned in the advisory. So, it’s time to schedule maintenance windows again, and patch those holes!

Cisco Joins the WiMax Bandwagon

2007-10-25T18:16:00.000+08:00

A few days after the U.N. announced the inclusion of WiMax as one of the IMT-2000 standards, Cisco Systems acquired one of the WiMax pioneers, Navini Networks, for $330 million in cash and assumed options. The acquisition will certainly enhance Cisco's IP Next Generation Network (IP NGN) architecture offerings.

Navini is a pioneer in the integration of "Smart Beamforming" technologies with Multi-Input Multi-Output (MIMO) antennas, a combination that improves the performance and range for WiMAX services and lowers the overall deployment and operational costs for service providers.

Navini's WiMAX products will extend Cisco's market-leading WiFi and WiFi-Mesh portfolios, allowing Cisco to uniquely address the rapidly growing markets for broadband wireless services.

I like to think that Cisco has really found something from Navini’s portfolio that is either compatible with their existing products, or a great new/innovative piece of technology, which will surely benefit the company in the WiMax arena. Either way, Cisco’s move is expected given their previous history of acquiring companies that will widen their business reach in the Networking industry.

So, what’s next, Cisco?

WiMax – The New Mobile Standard

2007-10-20T14:27:00.000+08:00

Getting my morning dose of news, I read that WiMax (Worldwide Interoperability for Microwave Access) is now officially a UN approved mobile standard. For me, this is good news since this will surely fast-forward the development of a technology that will provide wireless broadband Internet. Just image a DSL connection without the wires. Total mobility!

WiMax has been getting a lot of buzz for a few years now. It is positioned as a wireless broadband that will give faster connection, and reach of a longer distance. Just imagine a Wireless WAN with a lot more Mbps affixed to it. =)

I think it is now safe to expect WiMax capable devices to be available in the next 24 months. And within the next 3-5 years, we can expect to have low priced gadgets with this technology.

Further down the news, it’s noted that Sprint Nextel is rolling out a WiMax network in the U.S. Now, who will be the first in the Philippines?

640-801 CCNA Frenzy

2007-10-19T11:19:00.000+08:00

November 6, 2007. This is the last day of taking the old CCNA exam, 640-801. I know a lot of people who are cramming to review for this exam. There’s this rumor that the new CCNA exam, 640-802, is a lot harder and has new topics. Those who are already preparing to take the CCNA exam prefer not to review a lot more, and learn new topics, because this would definitely breach their self-imposed deadlines. =)

I went to the Career Certification link of Cisco, and sought the difference between the old and new CCNA exams.

In terms of training, non-CNAP (Cisco Networking Academy Program) students will need to take the following for the new CCNA exam:

Interconnecting Cisco Networking Devices Part 1 (ICND1) v1.0
Interconnecting Cisco Networking Devices Part 2 (ICND2) v1.0

where in old CCNA exam, you need to take the following:

Introduction to Cisco Networking Technologies (INTRO)
Interconnecting Cisco Networking Devices (ICND)

Comparing the exam topics, the new CCNA exam has the following main topics:

640-802 CCNA

Describe how a network works
Configure, verify and troubleshoot a switch with VLANs and inter-switch communications
Implement an IP addressing scheme and IP Services to meet network requirements in a medium-size Enterprise branch office network.
Configure, verify, and troubleshoot basic router operation and routing on Cisco devices
Explain and select the appropriate administrative tasks required for a WLAN
Identify security threats to a network and describe general methods to mitigate those threats
Implement, verify, and troubleshoot NAT and ACLs in a medium-size Enterprise branch office network.
Implement and verify WAN links

And for the old CCNA exam, the main topics are classified as such:

640-801 CCNA

Planning & Designing
Implementation & Operation
Troubleshooting
Technology

One thing I noticed is that the main topics for the new CCNA exam, are more descriptive. For more details on main topics, just click on the links given above.

In my opinion, I would highly recommend for those people who want to beat the Nov. 6 deadline to just postpone their exams and just review a bit more for the new exam. We need to take into consideration that one reason why there’s a new exam released is to incorporate newer technologies that are currently applied in today’s networks. If you want to be globally competitive, you’ll need to be up to date. And one way of showing that is by taking newer versions of a certification exam.

Now, if I’m going to hire a new addition to my team, I’ll certainly look for something ‘new’.

Lectures on LAN Switching – Part 03

2007-10-15T18:57:00.000+08:00

Broadcast Frame Forwarding

Frame Forwarding is usually done for Unicast frames. For Broadcast frames, the Destination MAC address is always FFFF.FFFF.FFFF. Let’s say PC(A1) sends out a Broadcast frame. Once the Switch receives a copy of the frame from port e1, it will inspect the Destination MAC address field. When the Switch finds out that the Destination MAC address is FFFF.FFFF.FFFF, it concludes that the frame is for broadcast. The Switch will then replicate and forward the frame to all switch ports, except for the port where it came from. This adheres to the concept of Switching wherein a Layer 2 Switch does not divide the broadcast domain.

Loop Avoidance through STP

Just imagine the setup above. If PC(A) wants to communicate with PC(B), there are two paths to choose from. In this setup, a single frame sent by PC(A) has the potential to bring down the Switches, or the setup in whole. Now, imagine that on a bigger scale. This will cost your job if you don’t resolve it. =)

How come? Well, in Switching, a frame doesn’t have a TTL value. So, when a frame is forwarded from the left segment by the upper Switch to the right segment, the frame will be delivered to PC(B) but another copy of the frame will be received by the lower Switch. The lower Switch will then forward the frame from right segment to the left segment. And this will continue forever due to the lack of TTL value. This continuous cycle is called a ‘switching loop’.

Also, the same ‘clockwise loop’ has the equivalent ‘counter clockwise loop’ since the PC(A) will also send another copy of the same frame to the lower Switch at the beginning the transmission process. Things get more complicated as more copies of the frame are replicated that leads to more loops.

When more loops are created, the Switch’s CPU will be burdened a lot more, and can lead to flapping port situation, or worse yet, a Switch crash scenario.

Switching loop is an inherent problem on Switches, when a computer network plan needs to provide redundant links. If redundancy is applied, you can expect every Switch-to-Switch connection to have at least a pair of parallel links between them.

To resolve this issue, a Switch applies a loop-avoidance mechanism called Spanning Tree Protocol (STP). STP will require a separate discussion since the topic itself is very expansive. In brief discussion, STP is a Layer 2 algorithm that will help keep the network loop-free, retain redundancy in case of link failures, and operate without initial configuration (plug and play) needed. In most brands of managed (intelligent) Switches, a flavor of STP is already enabled by default.

Lectures on LAN Switching – Part 02

2007-10-14T11:31:00.002+08:00

Main Functions

LAN Switches has four main functions.

MAC address Learning
Frame Forwarding or Filtering
Broadcast Frame Forwarding
Loop Avoidance through STP (Spanning Tree Protocol)

MAC address Learning

A Switch maintains a MAC address table, which is also known as the CAM (Content Addressable Memory) table. After boot up, the Switch will start receiving frames from its ports, and from these received frames; the Switch will store the MAC address from the Source MAC address field of the frame to the CAM table. After the Switch learned the Source MAC address of all connected devices, the table will then be used for the Frame Forwarding/Filtering function of the Switch.

Note: Destination MAC address is not involved the MAC Address Learning process, regardless of the packet type (Unicast/Broadcast).

Frame Forwarding or Filtering.

Let’s say you have PC(A1) that needs to communicate with PC(B1). With the CAM table already populated, the Switch will just need to check the Destination MAC address field of the frame coming from PC(A1). The Switch will then match it from the addresses present in the CAM table. Once the MAC address matches an entry from the CAM table, the Switch will use the associated port of the entry to forward the frame out of the switch. Both PC(B1) and PC(B2) will receive a copy of the frame, but only PC(B1) will accept it since it is only intended for this PC(B1).

Next, picture a setup wherein there is a Switch with 3 ports. Each port is a separate segment that shouldn’t affect other segments (also known as ‘micro segmentation’). Let’s say PC(A1) wants to communicate with PC(A2) on the same segment (same collision domain). PC(A1) sends a frame to the PC(A2) without any problem. But, another copy of the same frame will also be received by the port e1.

When the Switch inspects the Destination MAC address field of the frame, it sees that the Destination MAC address was learned from the same port. The Switch will decide that there’s no need for this frame to be forwarded anywhere else. This decision is called Frame Filtering.